From 0097cfee1d49c890fab7cf414dbcb2dfcede7556 Mon Sep 17 00:00:00 2001
From: Yuneng Jiang <yuneng@berri.ai>
Date: Wed, 3 Jun 2026 22:01:09 -0700
Subject: [PATCH] ci(coverage): isolate test-mcp upload in its own job and add
 concurrency

Mirror the two-job shape of _test-unit-base.yml: the test job keeps
contents: read and saves coverage.xml as an artifact, and a dependent
upload job carries the upload token, so the token is not present in the
job that runs the test suite. The upload job runs only when the test job
succeeds, so a -x abort cannot publish partial coverage. Adds the
concurrency group every other outer workflow already has so overlapping
pushes do not double-upload the mcp flag
---
 .github/workflows/test-mcp.yml | 42 ++++++++++++++++++++++++++++++----
 1 file changed, 38 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/test-mcp.yml b/.github/workflows/test-mcp.yml
index 20ec5ab270d..b8757d14623 100644
--- a/.github/workflows/test-mcp.yml
+++ b/.github/workflows/test-mcp.yml
@@ -15,12 +15,17 @@ on:
 
 permissions:
   contents: read
-  id-token: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 jobs:
   test:
     runs-on: ubuntu-latest
     timeout-minutes: 25
+    permissions:
+      contents: read
 
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
@@ -51,11 +56,40 @@ jobs:
         run: |
           uv run --no-sync pytest tests/mcp_tests -x -vv -n 4 --cov=./litellm --cov-report=xml --cov-config=pyproject.toml --durations=5
 
-      - name: Upload coverage to Codecov
-        if: success()
+      - name: Save coverage report
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: coverage-mcp-${{ github.run_id }}-${{ github.run_attempt }}
+          path: coverage.xml
+          retention-days: 1
+
+  upload-coverage:
+    name: Upload coverage to Codecov
+    needs: test
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Download coverage report
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
+        with:
+          pattern: coverage-mcp-${{ github.run_id }}-${{ github.run_attempt }}
+          path: coverage-reports
+          merge-multiple: true
+
+      - name: Upload to Codecov
         uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
         with:
           use_oidc: true
-          files: coverage.xml
+          directory: coverage-reports
+          root_dir: ${{ github.workspace }}
           flags: mcp
           fail_ci_if_error: false